Rogers Software Development Inc. wants to provide you with all the necessary computer security tips and settings to protect your computer and salon POS system against all the “nasties” trying to get into your system; and to proctect you and your company for any possible liability due to security breaches where hackers can access customer’s credit card data from.
The key word is “necessary” – what is really necessary to proctect your system among all the possible options out there to “protect” – what do you really need? You hear about anti virus, spyware removal, pop-up eliminators, firewalls, etc. , but what should you have and do to really protect your computer system from anauthorized access and security breaches? And most important; to protect your customer’s credit card information.
We have put together some documents with valuable and helpful salon software security information, check them in the following links:
Salon software Security Recommendations:
This is a document updated often that includes several security tips and instructions like General Configurations and best security practices for your pos system, Practical issues for Salon Owners with most common questions and answers regarding typical day to day situations when using your salon software, tips on setting up strong passwords for your salon software system, general salon software security questions and several other salon software security tips.
Check it at: http://www.supersalon.com/security/
Basic Salon Software Security Settings:
This document includes a basic salon software security settings guide to be used by users with non technical knowledge. Check it at: http://www.supersalon.com/basic-security-settings/
Advanced Salon Software Security Settings:
This document includes an advanced salon software security settings guide to be used by users with advanced technical knowledge. Check it at: http://www.supersalon.com/advanced-security-settings/
Rogers Software Development is also providing a professional salon software security check at a very cost effective price.
Check it at: http://www.supersalon.com/security-validation/
When it comes to computer systems and their complexity, security is always a concern that needs to be taken care off, specially when doing business and specially when customer’s sensitive data is involved.
Check your salon software security today!
SuperSalon Security Policies And Recommendations
This document establishes system configuration policies for all systems that we sell and support. Our intent is that these will represent policy for our staff and recommendations for our customers. The goal is to establish one secure configuration that we use on all systems to dramatically reduce that ability for personal information or payment information to be compromised at our customer locations. We expect this document to continually evolve. Note that Rogers Software cannot be responsible for ensuring that your business is PCI compliant or that your data is secure. PCI compliance involves many things out of our control including your network, your business policies and controls, etc. We are continually improving our systems, but we cannot guarantee full compliance. Please see the information links at the bottom of this page. For more information on PCI compliance we recommend you read the information on the following web site:
http://www.pcicomplianceguide.org/merchants.phpNote: It is the customer’s (merchant’s) responsibility to ensure these configurations and policies are in place.
4 basic steps to protect your computer from becoming infected:
Firewall:
- Windows XP firewall should be enabled.
- SuperSalon firewall should be installed and configured with “No Web Access” mode. A new version should be installed for salons with integrated processing that allows blocking of all domains except processor domains. (we are testing this now)
AntiVirus:
- We recommend an anti-virus / anti-spyware / anti-malware program be installed
- SPecifically, we recommend the use of Microsoft Security Essentials: http://www.microsoft.com/security_essentials/support.aspx?mkt=en-usEnsure that real time protection is enabled. This is FREE to customers with a licensed copy of the Windows operating system.
Network:
- Utilizing a router with a firewall is generally the “first line of defense” in a local area network.
- Internet Modems rarely have any sort of protection on them, so a firewalled router is always recommended
- Keep as few ports forwarded as possible, except the required for the system to function.
- Be sure to change all default passwords on the modem and router. See “Passwords” section for password creation advice
- If you have a wireless router, be sure to create a wireless key that must be used to access the wireless connection.
Card Processing:
- Use hosted solution like IP Charge that does not store data locally.
- We are currently studying the use of: http://www.verifone.com/industry-solutions/retail/payment-trends–security/verishield-protect.aspx
Third Party Software:
- VNC and other remote access software – Must use different password at each location. This can be a point of contention as customers want same password for ease of use.
System Configurations:
- Windows operating should be set for updates to install automatically.
Customer Staff Policies:
- Restrict access to the Internet for users. This is an excellent step to take to avoid spyware and viruses
- Restrict access to email on POS systems.
- Ensure users only have access to appropriate sections of the SuperSalon software via setup -> Permissions.
Rogers Staff Policies:
- Must confirm we are talking to owner to change salon passwords.
- Must not give customer credit card numbers to customers. This is a point of contention as customers will want them to re-run sales.
- VNC and other remote access software – Must use different password at each location. This can be a point of contention as customers want same password for ease of use.
In the works:
- Rogers is adding a “Kiosk Mode” feature that will force the computer to boot directly to SuperSalon and will not allow access to any other part of the computer.
This tool will make a password for you: http://www.pctools.com/guides/password/
The strongest passwords look like a random string of characters to attackers. But random strings of characters are hard to remember.
Make a random string of characters based on a sentence that is memorable to you but is difficult for others to guess.
- Think of a sentence that you will remember Example: “My son Aiden is three years old.”
- Turn your sentence into a password Use the first letter of each word of your memorable sentence to create a string, in this case: “msaityo”.
- Add complexity to your password or pass phrase Mix uppercase and lowercase letters and numbers. Introduce intentional misspellings. For example, in the sentence above, you might substitute the number 3 for the word “three”, so a password might be “MsAi3yo”.
- Substitute some special characters Use symbols that look like letters, combine words, or replace letters with numbers to make the password complex. Using these strategies, you might end up with the password “M$8ni3y0.”
- Test your new password with Password Checker Password Checker evaluates your password’s strength as you type.
- Keep your password a secret Treat your passwords with as much care as the information that they protect. For more information, see 5 tips to help keep your passwords secret.
- Change your password often
Qualities of strong passwords
Length
- Each character you add to your password increases the protection it provides.
- 8 or more characters are the minimum for a strong password; 14 characters or longer are ideal.
- The greater variety of characters that you have in your password, the harder it is to guess.
- An ideal password combines both length and different types of symbols.
- Use the entire keyboard.
- The easiest way to remember your passwords is to write them down.
- It is OK to write passwords down, but keep them secret so they remain secure and effective.
Password strategies to avoid
To avoid weak, easy-to-guess passwords:
- Avoid sequences or repeated characters“12345678,” “222222,” “abcdefg,” or adjacent letters on your keyboard do not make secure passwords.
- Avoid using only look-alike substitutions of numbers or symbolsCriminals will not be fooled by common look-alike replacements, such as to replace an ‘i’ with a ‘1′ or an ‘a’ with ‘@’ as in “M1cr0$0ft” or “P@ssw0rd”.These substitutions can be effective when combined with other measures, such as length, misspellings, or variations in case.
- Avoid your login nameDon’t use any part of your name, birthday, social security number, or similar information for your loved ones.This type of information is one of the first things criminals will try, and they can find it easily online from social networking sites, online resumes, and other public sources of data.
- Avoid dictionary words in any languageCriminals use sophisticated tools that can rapidly guess passwords that are based on words in multiple dictionaries, including words spelled backwards, common misspellings, profanity, and substitutions.
- Avoid using only one password for all your accountsIf your password is compromised on any one of the computers or online systems that use it, you should consider all of your other information protected by that password compromised as well.It is critical to use different passwords for different systems.
- Be careful with password recovery questionsMany Web sites offer a “password ” service that lets you provide the answer to a secret question. If you forget your password, the service will send it to you if you can remember the answer to your secret question.The questions are often random, but sometimes the answers to these questions are freely available on the Web. Choose your questions carefully or make up the answers.
- Avoid using online storage If criminals find your passwords stored online or on a networked computer, they have access to all your information.
PCI DSS Standards:
The core of the PCI DSS is a group of principles and accompanying requirements, around which the specific elements of the DSS are organized:
Build and Maintain a Secure Network
- Requirement 1: Install and maintain a firewall configuration to protect cardholder data
- Requirement 2: Do not use vendor-supplied defaults for system passwords and other security parameters
Protect Cardholder Data
- Requirement 3: Protect stored cardholder data
- Requirement 4: Encrypt transmission of cardholder data across open, public networks
Maintain a Vulnerability Management Program
- Requirement 5: Use and regularly update anti-virus software
- Requirement 6: Develop and maintain secure systems and applications
Implement Strong Access Control Measures
- Requirement 7: Restrict access to cardholder data by business need-to-know
- Requirement 8: Assign a unique ID to each person with computer access
- Requirement 9: Restrict physical access to cardholder data
Regularly Monitor and Test Networks
- Requirement 10: Track and monitor all access to network resources and cardholder data
- Requirement 11: Regularly test security systems and processes
Maintain an Information Security Policy
- Requirement 12: Maintain a policy that addresses information security
Security Questions And Answers for SuperSalon:
If you are a merchant, ask your POS vendor about the security of your system, with the following suggested questions:
- Is my POS software validated to the Payment Application Data Security Standard (refer to PCI SSC’s list of Validated Payment Applications)? NO
- Does my POS software store magnetic-stripe data (track data) or PIN blocks? If so, this storage is prohibited, so how quickly can you help me remove it? NO
- Will you document the list of files written by the application with a summary of the content of each file, to verify that the above-mentioned, prohibited data is not stored? In Progress
- Does your POS system require me to install a firewall to protect my systems from unauthorized access? YES
- Are complex and unique passwords required to access my systems? Can you confirm that you do not use common or default passwords for mine as well as other merchant systems you support? YES – We are instituting a written policy
- Have default settings and passwords been changed on the systems and databases that are part of the POS system?
- Have all unnecessary and insecure services been removed from the systems and databases that are part of the POS system? We are working on a list now of all unnecessary servcies such as Windows Messenger, and disabling them in systems we build.
- Here are some resources that explain security and how to disable unneeded services:
- Do you access POS system remotely? If so, have you implemented appropriate controls to prevent others from accessing my POS system, such as using secure remote access methods and not using common or default passwords? How often do you access my POS device remotely and why? Who is authorized to access my POS remotely? YES – Tech support staff to resolve technical issues when help line is called.
- Have all the systems and databases that are part of the POS system been patched with all applicable security updates? User responsibility to maintain operating system. Windows updates should be set to automatic.
- Is the logging capability turned on for the systems and databases that are part of the POS system? YES. You can turn on additional logging in the windows firewall under the “Advanced” tab.
- If prior versions of my POS software stored track data, has this feature been removed during updates: YES
Post Mortem Findings:
Investigations after compromises consistently show common PCI DSS violations, including but not limited to:
- Storage of magnetic stripe data (Requirement 3.2). It is important to note that many compromised entities are unaware that their systems are storing this data.
- Inadequate access controls due to improperly installed merchant POS systems, allowing hackers in via paths intended for POS vendors (Requirements 7.1, 7.2, 8.2 and 8.3)
- Default system settings and passwords not changed when system was set up (Requirement 2.1)
- Unnecessary and insecure services not removed or fixed when system was set up (Requirement 2.2.2)
- Poorly coded web applications resulting in SQL injection and other vulnerabilities, which allow access to the database storing cardholder data directly from the web site (Requirement 6.5)
- Missing and outdated security patches (Requirement 6.1)
- Lack of logging (Requirement 10)
- Lack of monitoring (via log reviews, intrusion detection/prevention, quarterly vulnerability scans, and file integrity monitoring systems) (Requirements 10.6, 11.2, 11.4 and 11.5)
- Lack of segmentation in a network, making cardholder data easily accessible through weaknesses in other parts of the network (for example, from wireless access points, employee email, and web browsing) (Requirements 1.3 and 1.4)
0
Back to top